From 62c0a87affaac3e26c8bda1c993234bf13cd711e Mon Sep 17 00:00:00 2001 From: "Adam C. Emerson" Date: Fri, 16 Nov 2018 14:42:33 -0500 Subject: [PATCH] rgw: Don't treat colons specially in resource part of ARN It is very important to prevent wildcards from matching across colons in some parts of the ARN. But it is equally important to allow them to do so in the last field. Fixes: http://tracker.ceph.com/issues/23817 Signed-off-by: Adam C. Emerson (cherry picked from commit 07c478b750c56d7dbbda42507a19c00d0fdedc15) --- src/rgw/rgw_common.cc | 7 +++++-- src/rgw/rgw_iam_policy.cc | 2 +- src/test/rgw/test_rgw_iam_policy.cc | 4 ++-- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/src/rgw/rgw_common.cc b/src/rgw/rgw_common.cc index 96007f398568..3ee90535f1f2 100644 --- a/src/rgw/rgw_common.cc +++ b/src/rgw/rgw_common.cc @@ -1870,12 +1870,15 @@ bool match_policy(boost::string_view pattern, boost::string_view input, { const uint32_t flag2 = flag & (MATCH_POLICY_ACTION|MATCH_POLICY_ARN) ? MATCH_CASE_INSENSITIVE : 0; + const bool colonblocks = !(flag & (MATCH_POLICY_RESOURCE | + MATCH_POLICY_STRING)); const auto npos = boost::string_view::npos; boost::string_view::size_type last_pos_input = 0, last_pos_pattern = 0; while (true) { - auto cur_pos_input = input.find(":", last_pos_input); - auto cur_pos_pattern = pattern.find(":", last_pos_pattern); + auto cur_pos_input = colonblocks ? input.find(":", last_pos_input) : npos; + auto cur_pos_pattern = + colonblocks ? pattern.find(":", last_pos_pattern) : npos; auto substr_input = input.substr(last_pos_input, cur_pos_input); auto substr_pattern = pattern.substr(last_pos_pattern, cur_pos_pattern); diff --git a/src/rgw/rgw_iam_policy.cc b/src/rgw/rgw_iam_policy.cc index 9f31db2eaad7..331802144db9 100644 --- a/src/rgw/rgw_iam_policy.cc +++ b/src/rgw/rgw_iam_policy.cc @@ -381,7 +381,7 @@ bool ARN::match(const ARN& candidate) const { return false; } - if (!match_policy(resource, candidate.resource, MATCH_POLICY_ARN)) { + if (!match_policy(resource, candidate.resource, MATCH_POLICY_RESOURCE)) { return false; } diff --git a/src/test/rgw/test_rgw_iam_policy.cc b/src/test/rgw/test_rgw_iam_policy.cc index 738ce1b78efc..3bae06f47ee2 100644 --- a/src/test/rgw/test_rgw_iam_policy.cc +++ b/src/test/rgw/test_rgw_iam_policy.cc @@ -942,7 +942,7 @@ TEST(MatchPolicy, Resource) EXPECT_TRUE(match_policy("a:b:c", "a:b:c", flag)); EXPECT_FALSE(match_policy("a:b:c", "A:B:C", flag)); // case sensitive EXPECT_TRUE(match_policy("a:*:e", "a:bcd:e", flag)); - EXPECT_FALSE(match_policy("a:*", "a:b:c", flag)); // cannot span segments + EXPECT_TRUE(match_policy("a:*", "a:b:c", flag)); // can span segments } TEST(MatchPolicy, ARN) @@ -960,5 +960,5 @@ TEST(MatchPolicy, String) EXPECT_TRUE(match_policy("a:b:c", "a:b:c", flag)); EXPECT_FALSE(match_policy("a:b:c", "A:B:C", flag)); // case sensitive EXPECT_TRUE(match_policy("a:*:e", "a:bcd:e", flag)); - EXPECT_FALSE(match_policy("a:*", "a:b:c", flag)); // cannot span segments + EXPECT_TRUE(match_policy("a:*", "a:b:c", flag)); // can span segments } -- 2.47.3